Miscellaneous operators :: Kloudfuse Docs
Miscellaneous operators
LogQL provides built-in functions that operate on metric query results: label_replace rewrites series labels with a regular expression, and vector produces a literal value — commonly used as a fallback so that empty results still return data.
label_replace
Adds or overwrites a label on every series by matching a regular expression against an existing label and expanding a replacement template with the capture groups. The original label is untouched. Use it to normalize names before joining two query results or to display friendlier series names.
Syntax
label_replace(<expr>, "<dst>", "<replacement>", "<src>", "<regex>")
Parameters
| Parameter | Required | Description |
|---|---|---|
<expr> |
Required | The metric expression to transform. |
<dst> |
Required | The label to write. |
<replacement> |
Required | Template for the new value; $1, $2 refer to capture groups. |
<src> |
Required | The label to match against. |
<regex> |
Required | An anchored RE2 expression; when it does not match, the series passes through unchanged. |
Example
Derive a service label from the source label on nginx log volume, prefixing it to match a service catalog’s naming.
label_replace(
sum by (source) (count_over_time({source="nginx"}[5m])),
"service", "ingress-$1", "source", "(.*)"
)
| service | source | Value |
|---|---|---|
| ingress-nginx | nginx | 5,135,802 |
Expected output
label_replace operates on metric query results; to rewrite labels inside a log pipeline, use label_format. |
vector
Returns the given scalar as a single series with no labels. Its main job is the fallback idiom <query> or vector(0): when the query returns nothing — no errors logged, no lines matched — the result is an explicit 0 instead of an empty panel, which keeps dashboards and downstream arithmetic well-defined.
Syntax
vector(<scalar>)
Parameters
| Parameter | Required | Description |
|---|---|---|
<scalar> |
Required | The numeric value to return. |
Example
Count log lines from a service that does not exist on this cluster. The count itself is empty, so the or vector(0) fallback supplies the 0.
sum(count_over_time({source="payments-service"}[5m])) or vector(0)
| Value |
|---|
| 0 |
Expected output
The fallback series has no labels; if later stages match on labels, add them with label_replace. |